Most not-for-profits don't have a risk-management process, partly because of the cost. But increasingly, more organizations are realizing that enterprise risk management can be a good tool to attract discerning donors. Not-for-profits can effectively implement and maintain enterprise risk management by creating a risk-management governance structure, following a risk-management framework, continuously identifying potential risk events, establishing risk responses and monitoring those risks.